Skip to content
OpenAdvisories

Vendor

WC Lovers

43 known vulnerabilities.

Products

WCFM – Frontend Manager for WooCommerce 11 WCFM Marketplace 8 WCFM Membership 7 WCFM Membership – WooCommerce Memberships for Multivendor Marketplace 6 WCFM Marketplace – Multivendor Marketplace for WooCommerce 6 WCFM – Multivendor Marketplace REST API for WooCommerce 2 WooCommerce Frontend Manager – Ultimate 1 WooCommerce Multivendor Marketplace – REST API 1 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-81286

    WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

    Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions.

    WC Lovers WCFM Marketplace
  • Critical 9.8
    CVE-2023-2276

    WCFM Membership – WooCommerce Memberships for Multivendor Marketplace <= 2.10.7 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Password Change

    The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 2.10.7. This is due to the plugin providing user-controlled access to objects, …

    WC Lovers WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Web / CMS
  • Critical 9.8
    CVE-2022-4939 Public exploit

    WCFM Membership <= 2.10.0 - Unauthenticated Privilege Escalation

    THe WCFM Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including 2.10.0, due to a missing capability check on the wp_ajax_nopriv_wcfm_ajax_controller AJAX action that controls membership settings. This makes it p…

    WC Lovers WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Web / CMS